update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic #3154

FedeDP · 2024-04-04T10:00:41Z

What type of PR is this?

/kind release

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:
This PR bumps falcoctl to v0.8.0-rc1.
Moreover, it:

Sets modern ebpf as default driver
Enables automatic driver selection logic as default behavior for deb,rpm and driver loader docker images

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

TODO:

update rpm/deb installation scripts
update docker images entrypoints

Does this PR introduce a user-facing change?:

new(scripts,docker)!: enable automatic driver selection logic in packages and docker images. Modern eBPF is now also the default driver and the highest priority one in the new driver selection logic.

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2024-04-04T10:01:05Z

scripts/falcoctl/falcoctl.yaml.in

@@ -1,5 +1,8 @@
 driver:
-    type: "kmod"
+    type:


Leverage new falcoctl feature to automatically select the best driver for us.

…n cmake configuration. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2024-04-09T07:35:44Z

scripts/falcoctl/falcoctl.yaml.in

@@ -1,5 +1,5 @@
 driver:
-    type: "kmod"
+    type: [@FALCOCTL_DRIVER_TYPES@]


The list of allowed types is dynamically set, eg: if modern bpf is not built, it won't be present.

👍

Order is correct 👇
https://github.com/falcosecurity/falco/pull/3154/files#diff-1fa114fd37754ac397e510000838b3f7bc8cbe1c517d67e680dd4644cfc99c21R51-R60

…eal with new automatic driver selection as default behavior. Signed-off-by: Federico Di Pierro <[email protected]>

Andreagit97

/approve

FedeDP · 2024-04-09T08:17:08Z

This is still wip :D

Signed-off-by: Federico Di Pierro <[email protected]>

…s entrypoints. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2024-04-09T08:12:16Z

scripts/debian/postinst.in

                ;;
        esac
-        if [ -n "$CHOICE" ]; then
+        if [ -n "$chosen_driver" ]; then


Just need to check whether any driver was actually chosen (ie: if neither FALCO_DRIVER_CHOICE=none was passd nor Manual configuration was set).

FedeDP · 2024-04-09T08:12:29Z

scripts/debian/postinst.in

@@ -17,7 +17,8 @@
 # limitations under the License.
 #

-chosen_driver=
+# By default, we use the automatic selection for drivers
+chosen_driver="auto"


New default is automatic selection.

FedeDP · 2024-04-09T08:13:15Z

scripts/debian/postinst.in

+            if [ "$chosen_driver" = "auto" ];  then
+                # Configure falcoctl to enable all drivers
+                falcoctl driver config --type "modern_ebpf" --type "ebpf" --type "kmod"
+                # Load the actually automatic chosen driver
+                chosen_driver=$(falcoctl driver printenv | grep DRIVER= | cut -d'"' -f2)


For automatic driver selection, configure falcoctl with all drivers; then use printenv to load the runtime selected driver; it is needed to know which systemd unit must be enabled.

FedeDP · 2024-04-09T08:13:32Z

scripts/rpm/postinstall.in

This file has same changes as the deb one.

FedeDP · 2024-04-12T13:16:00Z

docker/driver-loader-legacy/docker-entrypoint.sh

@@ -24,8 +24,10 @@ print_usage() {
 	echo "  docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro falcosecurity/falco-driver-loader-legacy:latest [driver] [options]"
 	echo ""
 	echo "Available drivers:"
-	echo "  kmod           kernel module (default)"
+	echo "  auto	       leverage automatic driver selection logic (default)"


Like for rpm/deb, automatic selection is the default.
In this case, there is no need to explicitly call

/usr/bin/falcoctl driver config --type modern_ebpf --type ebpf --type kmod

since that is already the default falcoctl config shipped within Falco (see https://github.com/falcosecurity/falco/pull/3154/files#diff-8cef78de718faa0811f718db1971271a3a7172a72b015e10bc59dc8077c5d4e2).
For dep and rpm, we always call it to eventually reset the falcoctl configuration upon package upgrade.

leogr

SGTM!

leogr · 2024-04-12T13:20:41Z

falco.yaml

@@ -322,7 +322,7 @@ rules_file:
 # buffers (higher `cpus_for_each_buffer`) can lower the memory footprint.
 #
 engine:
-  kind: kmod
+  kind: modern_ebpf


leogr · 2024-04-12T13:23:57Z

scripts/falcoctl/falcoctl.yaml.in

@@ -1,5 +1,5 @@
 driver:
-    type: "kmod"
+    type: [@FALCOCTL_DRIVER_TYPES@]


👍

Order is correct 👇
https://github.com/falcosecurity/falco/pull/3154/files#diff-1fa114fd37754ac397e510000838b3f7bc8cbe1c517d67e680dd4644cfc99c21R51-R60

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2024-04-12T14:06:29Z

Refs #3165

Andreagit97

/approve

poiana · 2024-04-15T13:12:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

update(cmake,scripts): bumped falcoctl to v0.8.0-rc1.

4179870

Signed-off-by: Federico Di Pierro <[email protected]>

poiana added release-note-none dco-signoff: yes kind/release area/build labels Apr 4, 2024

poiana requested review from Andreagit97 and Kaizhe April 4, 2024 10:00

poiana added approved size/S labels Apr 4, 2024

FedeDP commented Apr 4, 2024

View reviewed changes

FedeDP changed the title ~~update(cmake,scripts): bumped falcoctl to v0.8.0-rc1.~~ wip: update(cmake,scripts): bumped falcoctl to v0.8.0-rc1. Apr 4, 2024

poiana added the do-not-merge/work-in-progress label Apr 4, 2024

chore(scripts): dynamically set falcoctl allowed driver types based o…

d7da320

…n cmake configuration. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP commented Apr 9, 2024

View reviewed changes

poiana added size/L and removed size/S labels Apr 9, 2024

chore(scripts): updated debian and rpm post installation scripts to d…

4017492

…eal with new automatic driver selection as default behavior. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the bump/falcoctl branch from a4ee370 to 4017492 Compare April 9, 2024 08:11

Andreagit97 previously approved these changes Apr 9, 2024

View reviewed changes

poiana assigned Andreagit97 Apr 9, 2024

poiana added the lgtm label Apr 9, 2024

Andreagit97 added this to the 0.38.0 milestone Apr 9, 2024

update(falco.yaml): set modern_ebpf as default engine kind.

eba5e23

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP dismissed Andreagit97’s stale review via ca892fb April 12, 2024 13:13

chore(docker): support new automatic driver selection in docker image…

28bc3ad

…s entrypoints. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the bump/falcoctl branch from ca892fb to 28bc3ad Compare April 12, 2024 13:14

FedeDP commented Apr 12, 2024

View reviewed changes

leogr reviewed Apr 12, 2024

View reviewed changes

docs(scripts): leave a small comment.

23ef2ce

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP changed the title ~~wip: update(cmake,scripts): bumped falcoctl to v0.8.0-rc1.~~ update(cmake,scripts): bumped falcoctl to v0.8.0-rc1. Apr 12, 2024

poiana removed the do-not-merge/work-in-progress label Apr 12, 2024

leogr approved these changes Apr 12, 2024

View reviewed changes

poiana assigned leogr Apr 12, 2024

Andreagit97 approved these changes Apr 15, 2024

View reviewed changes

poiana merged commit 7cc57a9 into master Apr 15, 2024
33 checks passed

poiana deleted the bump/falcoctl branch April 15, 2024 13:13

FedeDP mentioned this pull request Apr 15, 2024

fix(docker,scripts): do not load falcoctl driver loader when installing Falco deb package in docker images #3166

Merged

poiana added release-note and removed release-note-none labels Apr 19, 2024

FedeDP changed the title ~~update(cmake,scripts): bumped falcoctl to v0.8.0-rc1.~~ update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic Apr 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic #3154

update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic #3154

FedeDP commented Apr 4, 2024 •

edited

Loading

FedeDP Apr 4, 2024

FedeDP Apr 9, 2024

leogr Apr 12, 2024

Andreagit97 left a comment

FedeDP commented Apr 9, 2024

FedeDP Apr 9, 2024

FedeDP Apr 9, 2024

FedeDP Apr 9, 2024 •

edited

Loading

FedeDP Apr 9, 2024

FedeDP Apr 12, 2024

leogr left a comment

leogr Apr 12, 2024

leogr Apr 12, 2024

FedeDP commented Apr 12, 2024

Andreagit97 left a comment

poiana commented Apr 15, 2024

update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic #3154

update(cmake,scripts): bumped falcoctl to v0.8.0-rc1 and set modern eBPF as default driver + enable automatic driver selection logic #3154

Conversation

FedeDP commented Apr 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

FedeDP commented Apr 9, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP Apr 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leogr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Apr 12, 2024

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Apr 15, 2024

FedeDP commented Apr 4, 2024 •

edited

Loading

FedeDP Apr 9, 2024 •

edited

Loading